Sanitize Project

Sanitize Project for Public Sharing

Clean up a project directory so it's safe and lightweight to share publicly. The goal: remove everything that's either private (credentials, keys) or regenerable (build output, dependencies).

---

STEP 1: Parse the Path

Get the target directory from the user's argument. If no path was given, ask for one.

Check that the directory exists before proceeding.

---

STEP 2: Copy First, Sanitize the Copy

Always sanitize a copy — never the original. The original stays untouched with its original name.

# The copy gets a "- Community" suffix (or similar distribution label)
COPY_DIR="${ORIGINAL_DIR} - Community"
cp -r "$ORIGINAL_DIR" "$COPY_DIR"

All subsequent steps operate on $COPY_DIR, not the original. Tell the user:

• Original preserved at: ``
• Sanitizing copy at: ``

---

STEP 3: Measure Before Size

du -sh "$COPY_DIR"

Save this number — you'll report it at the end.

---

STEP 4: Remove Build Artifacts & Caches

These are all regenerated automatically when the project is run — safe to delete:

# Remove each if it exists
node_modules/
.next/
.nuxt/
dist/
build/
.turbo/
.cache/
.parcel-cache/
__pycache__/
*.pyc
.pytest_cache/
.venv/
venv/
tsconfig.tsbuildinfo
*.tsbuildinfo
.DS_Store (all, recursively)

Use find + rm -rf to handle nested occurrences (e.g. nested node_modules).

Example:

find "/path/to/project" -name "node_modules" -type d -prune -exec rm -rf {} +
find "/path/to/project" -name ".DS_Store" -delete

---

STEP 5: Remove Lock Files

These are regenerated by npm install / pip install etc:

• package-lock.json
• yarn.lock
• pnpm-lock.yaml
• Pipfile.lock
• poetry.lock
• Gemfile.lock

---

STEP 6: Remove Version Control

.git/
.svn/
.hg/

The recipient doesn't need the git history.

---

STEP 7: Scan for Secrets & Credentials

Search ALL remaining files for patterns that suggest credentials. This is the most important step — missing a real API key in a public share is a serious problem.

Patterns to search for (case-insensitive):

• API_KEY, APIKEY
• SECRET, SECRET_KEY
• TOKEN, ACCESS_TOKEN, AUTH_TOKEN
• PASSWORD, PASSWD, PWD
• PRIVATE_KEY, PRIVATE KEY
• -----BEGIN RSA PRIVATE KEY-----
• sk- (OpenAI key prefix)
• sk-ant- (Anthropic key prefix)
• Bearer
• Common cloud prefixes: AKIA (AWS), AIza (Google)

Use grep to scan:

grep -rli "API_KEY\|SECRET\|TOKEN\|PASSWORD\|sk-\|AKIA\|AIza\|Bearer" /path/to/project \
  --include="*.env*" --include="*.json" --include="*.ts" --include="*.js" \
  --include="*.py" --include="*.yaml" --include="*.yml" --include="*.toml" \
  --include="*.sh" --include="*.conf" --include="*.config"

For each file flagged:

• Read the file
• Determine if the match is an actual credential value (e.g. OPENAI_API_KEY=sk-abc123) or just a variable reference/placeholder (e.g. OPENAI_API_KEY=your-key-here)
• Only warn/redact actual values, not placeholders

---

STEP 8: Handle .env Files

For any .env, .env.local, .env.production, .env.development files found:

1. Read the file
2. Check if it contains real values (not just placeholders like your-key-here, xxxxx, ``)
3. If it has real values:

• Create a .env.example that strips the values but keeps the key names:

`` OPENAI_API_KEY= NEXT_PUBLIC_SUPABASE_URL= ``

• Delete the original .env file with real values

1. If .env.example already exists and the .env only has real values, just delete .env
2. Tell the user which files were redacted

---

STEP 9: Measure After Size

du -sh "$COPY_DIR"

---

STEP 10: Report

Print a clean summary:

✅ Sanitization complete

📁 Original (untouched): /path/to/project
📦 Community copy: /path/to/project - Community
📦 Before: 458 MB → After: 268 KB

Removed:
  ✓ node_modules/ (458 MB)
  ✓ .next/ (309 MB)
  ✓ .git/ (648 KB)
  ✓ package-lock.json
  ✓ tsconfig.tsbuildinfo
  ✓ 3x .DS_Store files

Credentials:
  ✓ .env.local → replaced with .env.example (stripped real values)
  ⚠️  Possible credential pattern found in: src/config.ts — review manually

Ready to zip:
  zip -r MyProject.zip /path/to/project

If any files were flagged as potentially containing credentials but NOT auto-redacted (because they're code files, not env files), call them out explicitly so the user can review manually.

---

Notes

• Never delete files outside the target directory
• Be conservative: if unsure whether something is a real credential vs a placeholder, flag it for the user rather than silently redacting
• If the project has a .gitignore, use it as a hint — anything in .gitignore is often a good candidate for removal

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: duncan-buildroom
• Source: duncan-buildroom/profit-room-skills
• License: MIT

Install and usage instructions live in the source repository linked above.